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A METHOD FOR RECORDING EVENTS IN AN IP NETWORK 

BACKGROUND OF THE INVENTION 
5 1. Field of the Invention 

The present invention relates generally to telecommunications systems, and 

particularly to recording call event records in an IP network. 

2. Technical Background 

10 Telephony over the Internet is rapidly becoming a reality. Features that callers have 

come to expect from circuit switched systems are also considered essential for IP networks. 
One approach that is being considered to provide the system features needed to create and 
terminate calls in an IP network involves the Session Initiation Protocol (SIP). 

SIP is an application-layer signaling protocol that has been developed to create, 

15 modify, and terminate sessions having one or more users. These sessions include Internet 
telephone calls, multi-media conferences, and multi-media distribution. SIP functionality is 
typically resident on application servers. SIP servers are configured to provide telephonic 
services, and process call event information. Because vendors have developed their own 
custom SIP application programs, call events and telephonic services are processed by each 

20 vendors application server in a proprietary way. Unfortunately, when a network includes 
elements provided by a multiplicity of vendors, it becomes necessary to accommodate a 
variety of proprietary interfaces that enable the devices to transmit and receive call event 
information, billing information, monitoring information, fraud prevention data and other 
data. 

25 What is needed is a platform independent method for capturing SIP related events and 

other data in a uniform manner. Preferably, the system and method will be extensible, 
providing embedded information that will enable a receiving computer to read the generic, 
uniformly formatted records without needing a special proprietary interface. 

30 SUMMARY OF THE INVENTION 

The present invention relates to a platform independent method for capturing SIP 
related events and other data in a uniform manner. The method and system of the present 
invention is extensible. The method of the present invention produces generic, uniformly 
formatted records that can be read by a receiving computer without needing a special 
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proprietary interface. 

One aspect of the present invention is a method for capturing call event data in a 
telecommunications network. The method includes generating at least one call event record 
in response to at least one event. An XML call event file is created that includes the at least 
5 one call event record. 

In another aspect, the present invention includes a computer readable medium that can 
be used to direct a Session Initiation Protocol (SIP) server computer to function in a specified 
manner. The computer readable medium includes a SIP application layer software module. 
The SIP application layer software module is executable by the SIP server computer to 

10 provide SIP functionality. A call event record module is coupled to the SIP application layer 
software module. The call event record module is configured to create at least one call event 
record in response to at least one event An XML processor module is coupled to the call 
event record module. The XML processor module is configured to create an XML call event 
file. The XML call event file includes the at least one call event record. 

1 5 In another aspect, the present invention includes a set of application program 

interfaces embodied on a computer readable medium for execution on a computer. The set of 
application program interfaces includes a first interface that receives an event identifier and 
returns a call event record. The set of interfaces includes a second interface that receives a set 
of call event records and returns a call event file. The call event file includes the set of call 

20 event records. The call event file is an XML document written using the Extensible Markup 
Language (XML). 

In another aspect, the present invention includes a set of application program 
interfaces embodied on a computer readable medium for execution on a Session Initiation 
Protocol (SIP) server computer in conjunction with a SIP application layer software module 

25 that provides SIP functionality. The set of application program interfaces includes a first 
interface that receives a SIP event identifier and returns a call event record. The set of 
interfaces includes a second interface that receives a set of call event records and returns a 
call event file. The call event file includes the set of call event records. The call event file is 
written using the Extensible Markup Language (XML) and the call event file is an XML 

30 document. 

In another aspect, the present invention includes a communications network for 
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establishing a communications session between a first client and a second client. The 
communications network includes at least one Session Initiation Protocol (SIP) server 
computer. The SEP server computer includes a first call event record module configured to 
create a call event record corresponding to an event, and a first XML processor module 
5 configured to create a first XML call event file, the first XML call event file including the call 
event record. At least one network system is coupled to the at least one SIP server computer. 
The at least one network system includes a second XML processor module, whereby the at 
least one network system can read the first XML call event file. 

In another aspect, the present invention includes a computer-readable medium having 

10 stored thereon a data structure formatted as an XML document file. The data structure 
includes a server identifier section including information identifying the server that created 
the XML document file, a SIP message type section, and a SIP event section including 
information relating to a SIP message event. 

In another aspect, the present invention includes a computer readable medium having 

1 5 computer executable instructions for performing a method. The method includes the steps of: 
generating at least one call event record in response to at least one event; and, creating an 
XML call event file including the at least one call event record. 

Additional features and advantages of the invention will be set forth in the detailed 
description which follows, and in part will be readily apparent to those skilled in the art from 

20 that description or recognized by practicing the invention as described herein, including the 
detailed description which follows, the claims, as well as the appended drawings. 
It is to be understood that both the foregoing general description and the following detailed 
description are merely exemplary of the invention, and are intended to provide an overview or 
framework for understanding the nature and character of the invention as it is claimed. The 

25 accompanying drawings are included to provide a further understanding of the invention, and 
are incorporated in and constitute a part of this specification. The drawings illustrate various 
embodiments of the invention, and together with the description serve to explain the 
principles and operation of the invention. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Figure 1 is a block diagram of a communications network for establishing a 
communications sessions between a first user and a second user in accordance with the 
present invention; 

5 Figure 2 is a block diagram of a SIP server in accordance with the present invention; 

Figure 3 is a diagrammatic depiction of the structure of a Call Event Record XML 
file; and 

Figure 4 is a chart showing a method for recording call events in accordance with the 
present invention. 

10 

DETAILED DESCRIPTION 

Reference will now be made in detail to the present exemplary embodiments of the 
invention, examples of which are illustrated in the accompanying drawings. Wherever 
possible, the same reference numbers will be used throughout the drawings to refer to the 
1 5 same or like parts. An exemplary embodiment of the communications network of the present 
invention is shown in Figure 1, and is designated generally throughout by reference numeral 
10. 

In accordance with the invention, the present invention relates to a method for 
capturing call related events and messages in a telecommunications network. The method 

20 includes the step of generating a call event record in response to a call related event. A call 
event file is created that includes the call event record. The call event file is an XML 
document file. Thus, the method of the present invention is extensible and platform 
independent. The method captures call related SIP events and other data such that any 
application server can process the data in a uniform way. The present invention provides a 

25 method for providing generic, uniformly formatted records that can be read by any network 
device. The system and method of the present invention includes embedded instructions that 
enable a receiving computer to decode the records without needing a special proprietary 
interface. 

As embodied herein, and depicted in Figure 1 , a block diagram of a communications 
30 network for establishing a communications sessions between a first client and a second client 
in accordance with the present invention is disclosed. IP network 10 includes source client 
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12 coupled to SIP proxy server (SPS)14. Client 12 is referred to as a source client because it 
is the originator of the session participation request. Server 14 is coupled to SIP redirect 
server (RS)16, destination client 1 8 and network management system (NMS)20. Those of 
ordinary skill in the art will recognize that Figure 1 is merely a representative example. The 
5 present invention supports networks including a multiplicity of devices such as voice mail 
servers, conferencing servers and gateway devices. 

By way of example, source client 12 initiates a call attempt to destination client 18 by 
transmitting an INVITE request to SPS 14. SPS 14 acts as a proxy by relaying the INVITE 
message to client 18. If client 18 is available, client 18 transmits an OK message to client 12 

10 via SPS 14. On the other hand, if SPS 14 does not recognize the IP address of client 18, SPS 
14 may forward an INVITE message to RS 16. Subsequently, SPS 14 receives an alternative 
IP address for destination client 18 and provides that address to source client 12. Client 12 
retransmits an INVITE message to client 1 8 using the address provided by RS 16. The above 
described transactions are conducted using SIP request messages and SEP response messages 

15 which are also referred to as call events. The application servers record each call event in a 
call event record. All of the call event records produced over a predetermined amount of time 
are compiled in a Call Event Record file (CER file). The CER file is subsequently 
transmitted to NMS 20. Network status changes, fault conditions, and billing data, in 
addition to call event records can also be reported to NMS 20 via the CER files. In this way, 

20 billing, trouble-shooting, testing, and other back office functions resident in NMS 20 have 
access to the CER files. 

As embodied herein, and depicted in Figure 2, a block diagram of SIP server 100 in 
accordance with the present invention is disclosed. Server 100 includes SIP application 
software module 104 disposed in the memory of server computer 102. The memory of server 

25 computer 102 also includes call event record module 106 and other application software 
modules 110. SIP application software 104 provides SIP functionality. Call Event Record 
module 106 creates call event records in response to SIP call events or other events. XML 
processor 108 reads XML documents providing access to their content and structure. XML 
processor 108 does its work on behalf of application software modules. SEP application 

30 software modules 1 04 disposed in SPS 14 and RS 1 6, respectively, can be written as 
proprietary application software on different hardware platforms as long as each server 
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includes an XML processor. 

Referring back to Figure 2, module 104, module 106, module 108, and modules 1 10 
work together by way of a set of application program interfaces. One important interface 
receives call event information from SIP module 104 and provides it to Call Event Record 
5 module 1 06. Another important interface receives a set of call event records from Call Event 
Record module 106 and returns a Call Event Record (CER) file from module 108. The CER 
file includes the set of call event records collected by module 16 over a predetermined period 
of time. 

As embodied herein, and depicted in Figure 3, a diagrammatic depiction of the 

10 structure of CER file 300 in accordance with the present invention is disclosed. The CER file 
is an XML document. As discussed above, the XML document is the data exchange 
mechanism between different proprietary systems - whether they be applications, databases, 
or browsers. XML documents include storage units known as entities which contain parsed 
data and unparsed data. Parsed data includes "markup," which is used to encode a description 

15 of the documents storage layout and logical structure. The self describing feature of XML is 
one of its most important attributes - extensibility. When the application produces data, the 
XML processor is called to create an XML document having specific "tags." A tag is a string 
of unparsed data bracketed by delimiting punctuation. The XML processor in the receiving 
server parses the received XML document to determine the storage layout and logical 

20 structure of the XML document. However, the interpretation of the data is left to the 
application that calls XML processor 108. 

Referring back to Figure 3, CER file 300 has the following structure. It includes an 
XML document type declaration (DTD) section 302, server information section 304, SIP 
message type section 306, and event information section 308. DTD 302 provides a way of 

25 capturing the rules a designer adds to extend the core rules of XML syntax to thereby create a 
vocabulary to describe a particular event or situation. DTD section 302 also provides a way 
for an XML processor to unambiguously validate a particular XML document DTD 302 
provides data to describe the data in the tags. They describe the relationship between the tags 
found in the document, what attributes the tags are supposed to have, what attributes are 

30 default, and what values are mandatory. The XML processor module interprets DTD 302 
accompanying the received XML document before providing the data to the application 
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program. 

Server information section 304 identifies the creator of CER file 300. This section 
appears only once in CER file 300. Since a particular server may provide specific services 
such as conferencing, instant messaging (IM), or voice mail, the service description as well as 
5 vendor information is provided by this section. 

SIP message type section 306 appears for each call event record. This section 306 
includes a message identifier field that identifies the exact type of message, e.g., whether it is 
an INVITE or a 200 OK message. SIP message type section 306 also includes a CALL-ID 
field which provides the CALL-ID header associated with a particular SIP message. SIP 

1 0 message type section 306 includes a service ID field that uniquely identifies the service 
instance associated with the SIP message. For example, if the application server is providing 
conferencing services, the service ID field identifies the particular conference corresponding 
to the SIP message. This allows one to obtain all messages exchanged during a specific 
conference within a specific time period. In another example, if the server is a voice mail 

15 system, the service ID would identify a particular voice mail box. In yet another example, the 
service ID would link together all messages and events for a given call established by a proxy 
server. SIP message type section 306 also includes a To/From field that records the IP 
address and port number of both the originating and receiving servers. In another 
embodiment, only one or the other will be present in this field. Finally, SIP message type 

20 section 306 includes an "other messages" field. This field records other portions of a SIP 
message deemed necessary depending on the type of server making the call event record. 
This information may include additional headers or it may be the actual message body of the 
SIP message. 

CER file 300 also includes an Event Information Section 308 for each record. Event 
25 Information Section 308 records other events encountered in processing a particular SIP 
message. These other events include "INVITE TIMEOUT," "NON-INVITE TIMEOUT," 
"CONNECTION ERROR," "AUTHENTICATION PERFORMED," "FIND-ME FEATURE 
INVOKED," "DAP query sent," and etc. There may also be additional fields containing 
detailed information about an event. Of course, any modifications to this field will be defined 
30 in the DTD section. 

As embodied herein, and depicted in Figure 4, a chart showing a method for recording 
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call events in accordance with the present invention is disclosed. In step 400, the application 
server creates CER file 300. The length of the file is configurable, that is, call event records 
and other data are written into the CER files for a predetermined period of tune. After the 
time period elapses, a new CER file is started and the old file is archived by NMS 20. In step 
5 302 the application server determines if there is a call event, such as an INVITE, or some 
other such SIP message event. If so, the application server creates a call event record. 
Subsequently, the XML processor is called and the call event record is written in the CER file 
using XML. In step 308, the application server determines if the configurable file time period 
has elapsed. If not, the process flow returns to step 302 and the application server waits for 

10 another call event to record. If the time period has elapsed, the CER XML document file is 
transmitted to NMS 20 (See Figure 1). 

Those of ordinary skill in the art will recognize that CER files can be employed for 
any events occurring within network 10. Calls placed between all or any combinations of 
SIP-phones, enterprise gateways, network gateways, DAL gateways, INCP gateways, 

15 SIP-voicemail servers, and SIP conferencing servers may employ the present invention. 
Those of ordinary skill in the art will also recognize that the present invention can be 
employed using any suitable type of transport network. Further, the present invention is 
applicable to any type of session that may be established including, but not limited to, 
telephony, video, audio, instant messaging, and etcetera. It is also contemplated that the 

20 present invention may be employed for billing, monitoring, management, or for any of a wide 
variety of services performed by the network. 

It will be apparent to those skilled in the art that various modifications and variations 
can be made to the present invention without departing from the spirit and scope of the 
invention. Thus, it is intended that the present invention cover the modifications and 

25 variations of this invention provided they come within the scope of the appended claims and 
their equivalents. 
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What is claimed is: 



1 LA method for capturing call event data in a telecommunications network, the 

2 method comprising: 

3 creating an XML call event file including a server information section, at least one 

4 SIP 

5 message section, and at least one call event section; 

6 generating at least one call event record in response to at least one event; and 

7 storing the at least one call event record in either the at least one SIP message section, 

8 or the at least one call event section. 

1 2. The method of claim 1 , wherein the method is performed using a 

2 telecommunications network device. 

1 3. The method of claim 2, wherein the telecommunications network device is a SIP 

2 server computer. 

1 4. The method of claim 3, wherein the SIP server computer is a SIP proxy server. 

1 5. The method of claim 3, wherein the SIP server computer is a SIP redirect server. 

1 6. The method of claim 2, wherein the telecommunications network device is a 

2 network management system. 

1 7. The method of claim 6, wherein the network management system includes a 

2 database. 

1 8. The method of claim 6, wherein the network management system includes a LAN. 
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1 9. The method of claim 2, wherein the telecommunications network device is a SIP 

2 client device. 

1 1 0. The method of claim 1 , wherein the at least one event includes a SIP invite 

2 request. 

1 11. The method of claim 1 , wherein the at least one event includes a response to a SIP 

2 invite request. 

1 12. The method of claim 1 , wherein the at least one event includes a SIP redirection 

2 message. 

1 13. The method of claim 1, wherein the at least one event includes a SIP proxying 

2 request. 

1 14. The method of claim 1, wherein the at least one event includes a SIP proxying 

2 response message. 

1 15. The method of claim 1 , wherein the at least one event includes a SIP error 

2 message. 

1 16. The method of claim 1 , wherein the at least one event includes a network fault 

2 condition. 

1 17. The method of claim 1 , wherein the at least one event includes the transmission or 

2 reception of billing information. 

1 18. The method of claim 1 , wherein the at least one event is an event related to 

2 network monitoring. 
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1 1 9. The method of claim 1 , wherein the XML document includes a server information 

2 tag that identifies an originating server. 

1 20. The method of claim 1 , wherein the XML document includes a SIP message 

2 section identifying whether the event is a SIP request or a SIP response. 

1 21. The method of claim 20, wherein the SIP message section includes a service 

2 identifier field, the server identifier field uniquely identifying the service associated with the 

3 SIP message. 

1 22. The method of claim 20, wherein the SIP message section includes a send/receive 

2 field that includes IP addresses associated with a caller and a callee. 

1 23. The method of claim 20, wherein the SIP message section includes an other 

2 message content field that is used to accommodate any additional information. 

1 24. The method of claim 1 , wherein the XML document includes an event field 

2 identifying the event 

1 25 . The method of claim 1 , wherein the XML document includes a document type 

2 declaration section that provides information required by a receiving computer to properly 

3 decode the XML document. 

1 26. A computer readable medium that can be used to direct a Session Initiation 

2 Protocol (SIP) server computer to function in a specified manner, the computer readable 

3 medium comprising: 

4 a SIP application layer software module, the SEP application layer software module 

5 being executable by the SIP server computer to provide SIP functionality; 

6 a call event record module coupled to the SIP application layer software module, the 

7 call event record module being configured to create at least one call event record in response 

8 to at least one event; and 
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9 an XML processor module coupled to the call event record module, the XML 

10 processor module being configured to create an XML call event file, the XML call event file 

1 1 including the at least one call event record, 

1 27. The medium of claim 26, wherein the SIP server computer is configured as a SIP 

2 proxy server. 

1 28. The medium of claim 26, wherein the SIP server computer is configured as a SIP 

2 redirect server. 

1 29. The medium of claim 26, wherein the at least one event includes a SIP invite 

2 request. 

1 30. The medium of claim 26, wherein the at least one event includes a response to a 

2 SIP invite request. 

1 31. The medium of claim 26, wherein the at least one event includes a SIP redirection 

2 message. 

1 32. The medium of claim 26, wherein the at least one event includes a SIP proxying 

2 request. 

1 33 . The medium of claim 26, wherein the at least one event includes a SIP proxying 

2 response message. 

1 34. The medium of claim 26, wherein the at least one event includes an error message. 

1 35. The medium of claim 26, wherein the at least one event includes a network fault 

2 condition. 
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1 36. The medium of claim 26, wherein the at least one event includes the transmission 

2 or reception of billing information. 

1 37. The medium of claim 26, wherein the at least one event is an event related to 

2 network monitoring. 

1 38. The medium of claim 26, wherein the XML document includes a server 

2 information tag that identifies an originating server. 

1 39. The medium of claim 26, wherein the XML document includes a SIP message 

2 section identifying whether the event is a SIP request or a SIP response. 

1 40. The medium of claim 39, wherein the SIP message section includes a service 

2 identifier field, the server identifier field uniquely identifying the service associated with the 

3 SIP message. 

1 41 . The medium of claim 39, wherein the SIP message section includes a send/receive 

2 field that includes IP addresses associated with a caller and a callee. 

1 42. The medium of claim 39, wherein the SIP message section includes an other 

2 message content field that is used to accommodate any additional information. 

1 43. The medium of claim 26, wherein the XML document includes an event field 

2 identifying the event. 

1 44. The medium of claim 26, wherein the XML document includes a document type 

2 declaration section that provides information required by a receiving computer to properly 

3 decode the XML document. 

1 45. A set of application program interfaces embodied on a computer readable medium 

2 for execution on a computer, the set of application program interfaces comprising: 
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3 a first interface that receives an event identifier and returns a call event record; and 

4 a second interface that receives a set of call event records and returns a call event file, 

5 the call event file including the set of call event records, the call event file being written using 

6 the Extensible Markup Language (XML), whereby the call event file is an XML document. 

1 46. The program interfaces of claim 45, wherein the at least one event includes a SIP 

2 invite request. 

1 47. The program interfaces of claim 45, wherein the at least one event includes a 

2 response to a SIP invite request 

1 48. The program interfaces of claim 45, wherein the at least one event includes a SIP 

2 redirection message. 

1 49. The program interfaces of claim 45, wherein the at least one event includes a SIP 

2 proxying request. 

1 50. The program interfaces of claim 45, wherein the at least one event includes a SIP 

2 proxying response message. 

1 51 . The program interfaces of claim 45, wherein the at least one event includes a SIP 

2 error message. 

1 52. The program interfaces of claim 45, wherein the at least one event includes a 

2 network fault condition. 

1 53. The program interfaces of claim 45, wherein the at least one event includes the 

2 transmission or reception of billing information. 

1 54. The program interfaces of claim 45, wherein the at least one event is an event 

2 related to network monitoring. 
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1 55. The program interfaces of claim 45, wherein the XML document includes a server 

2 information tag that identifies an originating server. 

1 56. The program interfaces of claim 45, wherein the XML document includes a SIP 

2 message section identifying whether the event is a SIP request or a SIP response. 

1 57. The program interfaces of claim 45, wherein the XML document includes an 

2 event field identifying the event 

1 58. The program interfaces of claim 45, wherein the XML document includes a 

2 document type declaration section that provides information required by a receiving computer 

3 to properly decode the XML document. 

1 59. A set of application program interfaces embodied on a computer readable medium 

2 for execution on a Session Initiation Protocol (SIP) server computer in conjunction with a SIP 

3 application layer software module that provides SIP functionality, the set of application 

4 program interfaces comprising: 

5 a first interface that receives a SIP event identifier and returns a call event record; and 

6 a second interface that receives a set of call event records and returns a call event file, 

7 the call event file including the set of call event records, the call event file being written using 

8 the Extensible Markup Language (XML), whereby the call event file is an XML document. 

1 60. A communications network for establishing a communications session between a 

2 first client and a second client, the communications network comprising: 

3 at least one Session Initiation Protocol (SIP) server computer, the SIP server computer 

4 including a first call event record module configured to create a call event record 

5 corresponding to an event, and a first XML processor module configured to create a first 

6 XML call event file, the first XML call event file including the call event record; and 

7 at least one network system coupled to the at least one SIP server computer, the at 

8 least one network system including a second XML processor module, whereby the at least 
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1 61 . The network of claim 60, wherein the at least one SIP server computer includes at 

2 least one SIP proxy server and at least one SIP redirect server. 

1 62. The network of claim 6 1 , wherein the at least one SIP proxy server includes a 

2 plurality of SIP proxy servers, at least one of the plurality of SIP proxy servers being 

3 manufactured by a different manufacturer. 

1 63. The network of claim 61 , wherein the at least one SIP redirect server includes a 

2 plurality of SIP redirect servers, at least one of the plurality of SIP redirect servers being 

3 manufactured by a different manufacturer. 

1 64. The network of claim 61 , wherein the at least one SIP proxy server and the at least 

2 one SIP redirect server are manufactured by different manufacturers. 

1 65. The network of claim 60, wherein the at least one SIP server and the at least one 

2 network system are manufactured by different manufacturers. 

1 66. The network of claim 60, wherein the at least one network system includes a 

2 second call event record module configured to create a call event record corresponding to an 

3 event, the second XML processor module configured to create a second XML call event file, 

4 the second XML call event file including at least one call event record. 

1 67 . The network of claim 66, wherein the first XML processor module is configured 

2 to can decode the second XML call event file. 

1 68. The network of claim 67, wherein the first XML call event file includes a 

2 document type declaration section that provides information required by the second XML 

3 processor module to read the first XML call event file. 
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1 69. The network of claim 67, wherein the second XML call event file includes a 

2 document type declaration section that provides information required by the first XML 

3 processor module to read the second XML call event file. 

1 70. The network of claim 66, wherein both the first XML call event file and the 

2 second XML call event file include a server information tag that identifies an originating 

3 server. 

1 71 . The network of claim 66, wherein both the first XML call event file and the 

2 second XML call event file include a SIP message section identifying whether the event is a 

3 SIP request or a SIP response. 

1 72. The network of claim 66, wherein both the first XML call event file and the 

2 second XML call event file include an event field identifying the event. 

1 73 . A computer-readable medium having stored thereon a data structure formatted as 

2 an XML document file, the data structure comprising: 

3 a server identifier section including information identifying the server that created the 

4 XML document file; 

5 a SIP message type section; and 

6 a SIP event section including information relating to a SIP message event. 

1 74. The data structure of claim 73, wherein the server identifier section includes 

2 information identifying the vendor of the server. 

1 75. The data structure of claim 73, wherein the server identifier section includes the 

2 operating system running on the server. 

1 76. The data structure of claim 73, wherein the XML document is a call event record 

2 that includes a plurality of call event records. 
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1 77. The data structure of claim 77, wherein the SIP message section includes a service 

2 identifier field, the server identifier field uniquely identifying the service associated each call 

3 event record. 

1 78. The data structure of claim 73, wherein the SIP message section includes a 

2 send/receive field that includes IP addresses associated with a caller and a callee for each call 

3 event record. 



1 79. The data structure of claim 73, wherein the SIP message section indicates whether 

2 a call event record relates to a SIP request or a SIP response. 

1 80. The data structure of claim 73, wherein the SIP message section identifies the 

2 originator of each call event record contained in the XML document file. 

1 81. The data structure of claim 73, wherein the SIP message section identifies the 

2 receiving party of a call event record pertaining to a SIP message. 

1 82. The data structure of claim 73, wherein the SIP message section includes a time 

2 and date of each call event record contained in the XML document file. 

1 83. The data structure of claim 73, where the SIP event section identifies the event 

2 recorded by each call event record contained in the XML document file. 

1 84. The data structure of claim 73, wherein the XML document includes a document 

2 type declaration section that provides information required by a receiving computer to 

3 properly read the XML document. 

1 85. A computer readable medium having computer executable instructions for 

2 performing a method, the method comprising: 

3 generating at least one call event record in response to at least one event; and 

4 creating an XML call event file including the at least one call event record. 
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